Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.
Detected risks:
Detection and recovery of exposed version-control metadata and related build artifacts during authorized security assessments. The skill targets misconfigurations where a web server leaves source-control directories (.git, .svn, .hg, .bzr), macOS .DS_Store files, or backup and configuration artifacts (.env, backup.zip, config.php.bak, and similar) reachable over HTTP. It is intended for scope-controlled testing and stresses treating any recovered credentials or URLs as sensitive rather than exfiltrating real data beyond scope.
Work begins by probing a short list of high-value paths such as /.git/HEAD, /.git/config, /.svn/entries, /.svn/wc.db, /.hg/requires, /.bzr/README, /.DS_Store, and /.env. A key part of the methodology is reading HTTP status codes correctly: a 404 usually means the path is absent or blocked at the edge, while a 403 on a directory often signals that it exists but listing is denied, in which case direct file URLs should still be requested. A 403 on the directory combined with a 200 on HEAD is treated as a strong indicator of exposure and high priority for file-by-file extraction.
For recovery, the guide maps each system to open-source tooling: git-dumper, GitTools, and GitHacker for Git; svn-extractor or manual wc.db querying with sqlite3 plus /.svn/pristine/ retrieval for Subversion; a Mercurial dumper for .hg; and .DS_Store parsers for directory listings. A decision tree walks through probing each VCS in turn and fetching common backup extensions in parallel, and it cross-references companion recon skills for setting scope and request rate before deeper testing.
High-value targets include /.git/HEAD, /.git/config, /.svn/entries, /.svn/wc.db, /.hg/requires, /.bzr/README, /.DS_Store, and /.env, requested with GET or HEAD while respecting rate limits.
A 404 usually means the path is absent or fully blocked at the edge, while a 403 on the directory may mean it exists but listing is denied. A 403 on the directory plus a 200 on HEAD strongly indicates exposure, so you should still request individual file URLs.
It points to git-dumper, the GitTools Dumper/Extractor/Finder modules, and GitHacker for cases where standard dumpers miss edge cases.
Use svn-extractor for automated extraction, or manually download wc.db, query it with sqlite3 for file paths and checksums, then request /.svn/pristine/ blobs if they are exposed.
No. It is explicitly for authorized assessments only, and it instructs treating recovered credentials and URLs as sensitive and not exfiltrating real data beyond the agreed scope.
Quick Setup:
.claude/skills/Repository
yaklang/hack-skills